1 - First off, ArchivePage.php and UnarchivePage.php do not check if the request is POSTed or has an edit token, so an evil attacker can convince an election admin to archive or unarchive a page without their intention.
2 - Additionally, if one of the options for a single transferable vote with Droop quota poll is an cross-site scripting payload, such as <script>alert("OOPSIE WOOPSIE!!")</script>, then a voter would get XSSed if they voted for the malicious option. This problem is caused by line 432 of VotePage.php
3 - And also, VoterEligibitityPage#executeClear() does not check if the request is POSTed or has a valid edit token, thus also leading to the first problem.
4 - Also SetTwanslationHandler.php doesn't validate that the user is an election admin, so an arbitrary user can change the text even if they're not logged in!
Luckily, this functionality seems to be broken since MediaWiki 1.43, as it cannot properly get the request body and instead replies No valid body.
5 - Lastly, the functions ResultPage::getPagesTab() and ResultPage::getErrorsTab() does not escape user input! So if a malicious user can sneak in a malicious page name, this can happen:
Fortunately, the impact of this problem is reduced due to two things:
- All but one of the cross-site scripting vulnerable areas are inside elements' contents, which cannot contain the left-angle bracket or the right-angle bracket since it's a title
- Thus, the one vulnerable area is inside the attribute of an element. However, it depends on SetTranslationHandler.php to work to display, which we have already established doesn't on MediaWiki 1.43.
Question: For some reason, the edit token is checked when voting, but the request is still allowed if it's a CSRF
Instead, it has to validate that the CSRF flag is not unset.
Acceptance Criteria
- ArchivePage.php and UnarchivePage.php require token (gerrit:1149618)
- Droop quota poll option escapes input (gerrit:1149655)
- VoterEligibitityPage#executeClear() requires token (gerrit:1149664)
- SetTranslationHandler.php validates access rights (gerrit:1149668)
- ResultPage::getPagesTab() and ResultPage::getErrorsTab() escape user input (gerrit:1149669)